@cosmicdrift/kumiko-bundled-features 0.353.0 → 0.354.0

package/dist/agent-tools/agent-doc-lint.d.ts

@@ -4,6 +4,7 @@ export declare const AgentDocGapKinds: {
     readonly handlerWithoutDescription: "handler-without-description";
     readonly customScreenWithoutDescription: "custom-screen-without-description";
     readonly exposedEntityWithoutDescription: "exposed-entity-without-description";
+    readonly handlerWithoutTranslation: "handler-without-translation";
 };
 export type AgentDocGapKind = (typeof AgentDocGapKinds)[keyof typeof AgentDocGapKinds];
 export type AgentDocGap = {
@@ -13,4 +14,5 @@ export type AgentDocGap = {
     readonly message: string;
 };
 export declare function findAgentDocGaps(features: readonly FeatureDefinition[]): readonly AgentDocGap[];
+export declare function findHandlerTranslationGaps(features: readonly FeatureDefinition[]): readonly AgentDocGap[];
 export declare function formatAgentDocGap(gap: AgentDocGap): string;

package/dist/agent-tools/agent-doc-lint.js

@@ -1,10 +1,12 @@
-import { isAgentVisibleScreen, QnTypes, qn, resolveAgentExposure, toKebab, } from "@cosmicdrift/kumiko-framework/engine";
+import { handlerFieldLabelKey, handlerTitleKey, isAgentVisibleScreen, QnTypes, qn, resolveAgentExposure, toKebab, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { systemOnlyPropertyNames } from "./agent-manifest.js";
 export const AgentDocGapKinds = {
     handlerSchemaNotExpressible: "handler-schema-not-expressible",
     handlerWithoutDescription: "handler-without-description",
     customScreenWithoutDescription: "custom-screen-without-description",
     exposedEntityWithoutDescription: "exposed-entity-without-description",
+    handlerWithoutTranslation: "handler-without-translation",
 };
 // No shared screen-type union exists in the codebase to import (ScreenDefinition
 // is a discriminated union keyed by inline string literals) — name the one
@@ -107,6 +109,57 @@ function exposedEntityDocGaps(feature) {
     }
     return gaps;
 }
+function actionFormHandlerQns(features) {
+    const handlerQns = new Set();
+    for (const feature of features) {
+        for (const screen of Object.values(feature.screens ?? {})) {
+            if (screen.type === "actionForm")
+                handlerQns.add(screen.handler);
+        }
+    }
+    return handlerQns;
+}
+function agentVisibleInputFieldNames(schema) {
+    if (!(schema instanceof z.ZodObject))
+        return [];
+    const fieldNames = Object.keys(schema.shape);
+    try {
+        const systemOnly = new Set(systemOnlyPropertyNames(z.toJSONSchema(schema, { io: "input" })));
+        return fieldNames.filter((field) => !systemOnly.has(field));
+    }
+    catch {
+        // skip: a schema without JSON Schema form is reported as its own gap kind
+        return fieldNames;
+    }
+}
+function translationGapsOfFeature(feature, coveredHandlerQns) {
+    const gaps = [];
+    // The client resolves translation keys verbatim (no feature prefix), so only
+    // fully spelled-out keys count.
+    const translated = new Set(Object.keys(feature.translations ?? {}));
+    for (const [name, def] of Object.entries(feature.writeHandlers ?? {})) {
+        if (!resolveAgentExposure(def, "write").expose)
+            continue;
+        if (feature.handlerEntityMappings?.[name] !== undefined)
+            continue;
+        const handlerQn = qn(toKebab(feature.name), QnTypes.write, toKebab(name));
+        if (coveredHandlerQns.has(handlerQn))
+            continue;
+        const missing = [
+            handlerTitleKey(handlerQn),
+            ...agentVisibleInputFieldNames(def.schema).map((field) => handlerFieldLabelKey(handlerQn, field)),
+        ].filter((key) => !translated.has(key));
+        if (missing.length === 0)
+            continue;
+        gaps.push({
+            qn: handlerQn,
+            feature: feature.name,
+            kind: AgentDocGapKinds.handlerWithoutTranslation,
+            message: `This write handler has no entity and no actionForm screen, so its title and field labels can only come from translations — missing keys: ${missing.join(", ")}.`,
+        });
+    }
+    return gaps;
+}
 export function findAgentDocGaps(features) {
     const gaps = [];
     for (const feature of features) {
@@ -119,6 +172,13 @@ export function findAgentDocGaps(features) {
     // depend on it (mirrors agent-manifest.ts's sortedByKey rationale).
     return [...gaps].sort((a, b) => compareByCodePoint(a.qn, b.qn));
 }
+// Kept out of findAgentDocGaps on purpose: the published agent-manifest guard
+// fails on every gap that function returns, and these are advisory.
+export function findHandlerTranslationGaps(features) {
+    const coveredHandlerQns = actionFormHandlerQns(features);
+    const gaps = features.flatMap((feature) => translationGapsOfFeature(feature, coveredHandlerQns));
+    return [...gaps].sort((a, b) => compareByCodePoint(a.qn, b.qn));
+}
 export function formatAgentDocGap(gap) {
     return `${gap.qn} — ${gap.message}`;
 }

package/dist/agent-tools/agent-manifest.d.ts

@@ -1,4 +1,5 @@
 import type { AgentManifest, AgentManifestOptions, RegistryManifestView } from "./types.js";
+export declare function systemOnlyPropertyNames(jsonSchema: Record<string, unknown>): readonly string[];
 /** Registry snapshot → AI-agent manifest. Pure, deterministic, no I/O — mirrors
  *  `buildToolCatalog`'s contract, just describing the app's shape instead of
  *  generating callable tools from it. */

package/dist/agent-tools/agent-manifest.js

@@ -119,13 +119,19 @@ function buildFeatures(features) {
 }
 // Agent dispatch never runs as a system identity, so properties the engine only
 // honors for system callers would be silently dropped — hide them from the tool.
-function withoutSystemOnlyProperties(jsonSchema) {
+export function systemOnlyPropertyNames(jsonSchema) {
     const properties = jsonSchema["properties"];
     if (typeof properties !== "object" || properties === null)
-        return jsonSchema;
-    const hidden = Object.entries(properties)
+        return [];
+    return Object.entries(properties)
         .filter(([, property]) => property[SYSTEM_ONLY_JSON_SCHEMA_KEY] === true)
         .map(([name]) => name);
+}
+function withoutSystemOnlyProperties(jsonSchema) {
+    const properties = jsonSchema["properties"];
+    if (typeof properties !== "object" || properties === null)
+        return jsonSchema;
+    const hidden = systemOnlyPropertyNames(jsonSchema);
     if (hidden.length === 0)
         return jsonSchema;
     const required = jsonSchema["required"];

package/dist/agent-tools/feature.js

@@ -1,5 +1,5 @@
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { findAgentDocGaps, formatAgentDocGap } from "./agent-doc-lint.js";
+import { findAgentDocGaps, findHandlerTranslationGaps, formatAgentDocGap, } from "./agent-doc-lint.js";
 export const AGENT_TOOLS_FEATURE_NAME = "agent-tools";
 export function createAgentToolsFeature() {
     return defineFeature(AGENT_TOOLS_FEATURE_NAME, (r) => {
@@ -14,8 +14,13 @@ export function createAgentToolsFeature() {
         // would turn every incrementally-documented app into an outage.
         r.bootCheck(({ features }) => {
             const gaps = findAgentDocGaps(features);
+            const warningCount = findHandlerTranslationGaps(features).length;
+            if (warningCount > 0) {
+                // biome-ignore lint/suspicious/noConsole: operator-visibility at boot for agent-doc gaps
+                console.warn(`[agent-tools] ${warningCount} agent-exposed write handler(s) lack title/field-label translations — run \`kumiko agent lint\` for details.`);
+            }
             if (gaps.length === 0) {
-                // skip: no documentation gaps, nothing to warn about
+                // skip: no blocking documentation gaps, nothing more to warn about
                 return;
             }
             // biome-ignore lint/suspicious/noConsole: operator-visibility at boot for agent-doc gaps

package/dist/agent-tools/index.d.ts

@@ -1,5 +1,5 @@
 export type { AgentDocGap, AgentDocGapKind } from "./agent-doc-lint.js";
-export { AgentDocGapKinds, findAgentDocGaps, formatAgentDocGap } from "./agent-doc-lint.js";
+export { AgentDocGapKinds, findAgentDocGaps, findHandlerTranslationGaps, formatAgentDocGap, } from "./agent-doc-lint.js";
 export { buildAgentManifest } from "./agent-manifest.js";
 export { AGENT_TOOLS_FEATURE_NAME, createAgentToolsFeature } from "./feature.js";
 export { buildToolCatalog, OPEN_FORM_TOOL_NAME, toolNameForQn } from "./tool-catalog.js";

package/dist/agent-tools/index.js

@@ -1,4 +1,4 @@
-export { AgentDocGapKinds, findAgentDocGaps, formatAgentDocGap } from "./agent-doc-lint.js";
+export { AgentDocGapKinds, findAgentDocGaps, findHandlerTranslationGaps, formatAgentDocGap, } from "./agent-doc-lint.js";
 export { buildAgentManifest } from "./agent-manifest.js";
 export { AGENT_TOOLS_FEATURE_NAME, createAgentToolsFeature } from "./feature.js";
 export { buildToolCatalog, OPEN_FORM_TOOL_NAME, toolNameForQn } from "./tool-catalog.js";

package/dist/agent-tools/tool-dispatch.js

@@ -1,4 +1,4 @@
-import { runAsDirectCallEntry } from "@cosmicdrift/kumiko-framework/api";
+import { runAsDirectCallEntry } from "@cosmicdrift/kumiko-framework/internal/request-context";
 import { FILTER_OPS, isRecord } from "./filter-ops.js";
 const SEARCH_RESULT_LIMIT = 10;
 const DEFAULT_LIST_LIMIT = 10;

package/dist/auth-email-password/handlers/change-password.write.js

@@ -16,6 +16,7 @@ export const changePasswordWrite = defineWriteHandler({
     }),
     access: { roles: access.authenticated },
     escapeHatch: {
+        grants: ["systemIdentity"],
         reason: "Reads the caller's own passwordHash (privileged-only field) via ctx.queryAs(SYSTEM, ...) " +
             "and writes the new hash via ctx.writeAs(SYSTEM, user:update) — the caller's own " +
             "identity can't reach either, field-access on passwordHash is privileged-only.",

package/dist/auth-email-password/handlers/invite-accept-with-login.write.js

@@ -29,7 +29,7 @@ import { decryptStoredPii, sessionLocaleField, sessionTimezoneField } from "../.
 // kumiko-lint-ignore cross-feature-import invite-flow
 import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../../tenant/invitation-table.js";
 // kumiko-lint-ignore cross-feature-import membership grant for a privileged cross-tenant add
-import { grantInvitedMembershipRole, invitationIssuedAt } from "../../tenant/invited-membership.js";
+import { grantInvitedMembershipRole } from "../../tenant/invited-membership.js";
 // kumiko-lint-ignore cross-feature-import global roles granted on invite accept live on the user row
 import { grantInvitedGlobalRoles, parseInvitedGlobalRoles, } from "../../user/invited-global-roles.js";
 // kumiko-lint-ignore cross-feature-import login-style password-check
@@ -118,7 +118,7 @@ export function createInviteAcceptWithLoginHandler(opts = {}) {
                     userId,
                     tenantId: invitationTenantId,
                     role: invitationRole,
-                    invitationIssuedAt: invitationIssuedAt(invitation),
+                    invitation,
                 });
                 if (!grant.isSuccess)
                     return grant;

package/dist/auth-email-password/handlers/invite-accept.write.js

@@ -23,7 +23,7 @@ import { decryptStoredPii } from "../../shared/index.js";
 // kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link), DB-row-owner ist tenant-feature
 import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../../tenant/invitation-table.js";
 // kumiko-lint-ignore cross-feature-import membership grant for a privileged cross-tenant add (like provisionSignupAccount)
-import { grantInvitedMembershipRole, invitationIssuedAt } from "../../tenant/invited-membership.js";
+import { grantInvitedMembershipRole } from "../../tenant/invited-membership.js";
 // kumiko-lint-ignore cross-feature-import global roles granted on invite accept live on the user row
 import { grantInvitedGlobalRoles, parseInvitedGlobalRoles, } from "../../user/invited-global-roles.js";
 // kumiko-lint-ignore cross-feature-import auth handler reads user-row für email-match
@@ -93,7 +93,7 @@ export function createInviteAcceptHandler() {
                     userId: event.user.id,
                     tenantId: invitationTenantId,
                     role: invitationRole,
-                    invitationIssuedAt: invitationIssuedAt(invitation),
+                    invitation,
                 });
                 if (!grant.isSuccess)
                     return grant;

package/dist/auth-email-password/handlers/invite-create.write.js

@@ -24,10 +24,14 @@ import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 // kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link-Pattern), DB-row-owner ist tenant-feature
 import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../../tenant/invitation-table.js";
+// kumiko-lint-ignore cross-feature-import membership version read is owned by the tenant feature
+import { membershipVersionOf } from "../../tenant/invited-membership.js";
 // kumiko-lint-ignore cross-feature-import membership-role validation owned by tenant-feature
 import { findForbiddenMembershipRole, findForbiddenRoleAssignment, reservedMembershipRoleError, unassignableMembershipRoleError, } from "../../tenant/membership-roles.js";
 // kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
 import { GLOBAL_ROLE_OPTIONS } from "../../user/constants.js";
+// kumiko-lint-ignore cross-feature-import invitee lookup by email reads the user row
+import { userTable } from "../../user/schema/user.js";
 import { AUTH_INVITE_DEFAULT_TTL_MINUTES } from "../constants.js";
 import { renderInviteEmail } from "../email-templates.js";
 import { inviteAlreadyAccepted } from "../errors.js";
@@ -61,6 +65,16 @@ function checkAssignableInviteRole(opts, inviterRoles, role, ctx) {
     }
     return undefined;
 }
+// 0 = the invitee has no membership in the tenant yet (or no account at all).
+async function currentMembershipVersion(ctx, tenantId, email) {
+    const user = await ctx.db.global(userTable).fetchOne({
+        email,
+        isDeleted: false,
+    });
+    if (!user)
+        return 0;
+    return membershipVersionOf(ctx.db, tenantId, user.id);
+}
 async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAccepted = false) {
     if (!ctx.redis) {
         return writeFailure(new InternalError({ message: "invite-create requires ctx.redis for token store" }));
@@ -72,6 +86,7 @@ async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAc
     // The unique index allows one row per (tenantId, email). Whatever its
     // status, a re-invite resets it to pending with a fresh token.
     const existing = await ctx.db.fetchOne(tenantInvitationsTable, { tenantId, email });
+    const membershipVersion = await currentMembershipVersion(ctx, tenantId, email);
     let invitationId;
     if (existing) {
         // Provisioning callers (waitlist) must not flip an accepted invite back to
@@ -96,6 +111,7 @@ async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAc
                 globalRoles: [...request.globalRoles],
                 status: INVITATION_STATUS.pending,
                 invitedBy: inviter.id,
+                membershipVersion,
                 expiresAt,
             },
         }, inviter, ctx.db);
@@ -109,6 +125,7 @@ async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAc
             globalRoles: [...request.globalRoles],
             status: INVITATION_STATUS.pending,
             invitedBy: inviter.id,
+            membershipVersion,
             expiresAt,
         }, inviter, ctx.db);
         if (!createResult.isSuccess)

package/dist/auth-email-password/handlers/invite-signup-complete.write.js

@@ -21,7 +21,7 @@ import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-f
 import { buildSessionRoles, createSystemUser, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { decryptStoredPii } from "../../shared/index.js";
+import { decryptStoredPii, registrationLocaleFromRequest } from "../../shared/index.js";
 // kumiko-lint-ignore cross-feature-import invite-flow
 import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../../tenant/invitation-table.js";
 // kumiko-lint-ignore cross-feature-import reserved-role check owned by tenant-feature
@@ -92,11 +92,13 @@ export function createInviteSignupCompleteHandler(opts = {}) {
                 // @cast-boundary db-runner — helpers use only the query API that
                 // DbConnection and DbTx share.
                 const dbConn = ctx.db.unsafeRaw();
+                const registrationLocale = registrationLocaleFromRequest();
                 const { id: userId } = await seedUserWithPassword(dbConn, {
                     email: invitationEmail,
                     password: event.payload.password,
                     displayName: invitationEmail.split("@")[0] ?? invitationEmail,
                     emailVerified: true,
+                    ...registrationLocale,
                     ...(invitationGlobalRoles.length > 0 && { roles: invitationGlobalRoles }),
                 });
                 // Membership-Add via seed-helper (gleiches Pattern wie
@@ -136,6 +138,7 @@ export function createInviteSignupCompleteHandler(opts = {}) {
                     id: userId,
                     tenantId: invitationTenantId,
                     roles: mergedRoles,
+                    ...registrationLocale,
                 };
                 committed = true;
                 return {

package/dist/auth-email-password/handlers/login.write.js

@@ -151,6 +151,7 @@ export function createLoginHandler(opts = {}) {
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
         escapeHatch: {
+            grants: ["systemIdentity", "unsafeRaw"],
             reason: "Unauthenticated login has no caller identity yet — it looks up the user row by " +
                 "email via ctx.queryAs(SYSTEM, ...) and resolves tenant membership via " +
                 "ctx.resolveActiveMembership before a session exists. It also reads the MFA " +

package/dist/auth-email-password/handlers/reset-password.write.js

@@ -23,6 +23,7 @@ export function createResetPasswordHandler(opts) {
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
         escapeHatch: {
+            grants: ["systemIdentity"],
             reason: "Anonymous token holder has no session — runConfirmTokenFlow loads and updates the " +
                 "target user via ctx.writeAs(SYSTEM, user:update) to set the new password hash.",
         },

package/dist/auth-email-password/handlers/signup-confirm.write.js

@@ -24,7 +24,7 @@ import { ConflictError, InternalError, reraiseAsKumikoError, writeFailure, } fro
 import { generateUniqueName } from "@cosmicdrift/kumiko-framework/random";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
-import { findSignupHandoverProvider, SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE, } from "../../shared/index.js";
+import { findSignupHandoverProvider, registrationLocaleFromRequest, SIGNUP_HANDOVER_BENIGN_CLAIM_REJECTION_CODE, } from "../../shared/index.js";
 // kumiko-lint-ignore cross-feature-import signup-confirm reads tenants.key for slug-uniqueness check (TOCTOU + DB-unique-index zusammen)
 import { tenantTable } from "../../tenant/schema/tenant.js";
 import { invalidSignupToken, signupEmailAlreadyRegistered } from "../errors.js";
@@ -116,6 +116,7 @@ export function createSignupConfirmHandler(opts = {}) {
                 // Display-Name aus email-prefix als sinnvolles Default; User kann
                 // den Tenant-Namen + sein eigenes displayName später ändern.
                 const displayName = email.split("@")[0] ?? email;
+                const registrationLocale = registrationLocaleFromRequest();
                 let provisioned;
                 try {
                     provisioned = await provisionSignupAccount(dbConn, {
@@ -126,6 +127,7 @@ export function createSignupConfirmHandler(opts = {}) {
                         tenantKey,
                         // Generated slug as default name: no personal data (the email) in the tenant name.
                         tenantName: tenantKey,
+                        ...registrationLocale,
                     }, 
                     // #1463: seedTenant's postSave hooks (tier-engine's auto-default-
                     // tier, an app's auto-default-compliance) must fire on self-signup
@@ -150,6 +152,7 @@ export function createSignupConfirmHandler(opts = {}) {
                     id: provisioned.userId,
                     tenantId: provisioned.tenantId,
                     roles: [...INITIAL_SIGNUP_ROLES],
+                    ...registrationLocale,
                 };
                 // Claim BEFORE spending the signup token or the binding below and
                 // before `committed` flips: if the claim throws, the `finally` still

package/dist/auth-email-password/handlers/signup-request.write.js

@@ -20,18 +20,14 @@
 // stays always-200 + resend-idempotent so the request path leaks nothing;
 // suppressing the link on the request side would be defense-in-depth, but
 // with an enumeration risk of its own (separate concern).
-import { generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 import { findSignupHandoverProvider } from "../../shared/index.js";
-import { AUTH_SIGNUP_DEFAULT_TTL_MINUTES } from "../constants.js";
-import { renderActivationEmail } from "../email-templates.js";
-import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.js";
+import { resolveHandlerMailLocale } from "../magic-link-mail.js";
 import { AUTH_SELF_REGISTRATION_FEATURE } from "../self-registration-toggle.js";
-import { invalidateExistingSignupToken, normalizeEmail, storeSignupHandover, storeSignupToken, takeOverSignupHandoverForResend, } from "../signup-token-store.js";
-const SIGNUP_NOTIFICATION_TYPE = "auth-email-password:signup-activation";
+import { issueSignupActivation } from "../signup-activation.js";
+import { storeSignupHandover, takeOverSignupHandoverForResend } from "../signup-token-store.js";
 const SignupRequestSchema = z.object({
     email: z.email(),
     // Cross-device try-first handover (kumiko-framework#3035 follow-up,
@@ -47,8 +43,6 @@ const SignupRequestSchema = z.object({
 });
 const HANDOVER_GRANT_VERIFY_REASON = "verifies a tenant-handover grant against its root row in the source tenant (read-only anchor lookup) before binding it to the signup token";
 export function createSignupRequestHandler(opts) {
-    const ttlMinutes = opts.tokenTtlMinutes ?? AUTH_SIGNUP_DEFAULT_TTL_MINUTES;
-    const ttlSeconds = ttlMinutes * 60;
     return defineWriteHandler({
         name: "signup-request",
         schema: SignupRequestSchema,
@@ -93,84 +87,64 @@ export function createSignupRequestHandler(opts) {
             // the visitor just retyped their email) must still carry the earlier
             // verified grant over to the new token instead of silently dropping it.
             const priorBinding = await takeOverSignupHandoverForResend(ctx.redis, email);
-            // At most one live signup token per email: invalidate whatever's
-            // there before minting the new one (see signup-token-store.ts).
-            await invalidateExistingSignupToken(ctx.redis, email);
-            // 32 random bytes = 256 bits unguessable randomness, base64url
-            // encoded to 43 chars. Math.random used to be a bug here:
-            // xorshift128+ has ~128 bits of state that's reconstructible after
-            // ~5 observed outputs — an attacker could trigger their own
-            // signup-requests and predict other users' tokens. generateToken
-            // uses randomBytes from node:crypto, the same source as CSRF/
-            // session tokens.
-            const token = generateToken();
-            const issuedAt = Temporal.Now.instant();
-            const expiresAt = issuedAt.add({ seconds: ttlSeconds });
-            const expiresAtIso = expiresAt.toString();
-            await storeSignupToken(ctx.redis, { email, token, ttlSeconds });
-            // A handover grant in this request re-verifies and replaces the prior
-            // binding; anything short of a fresh, verified grant (no provider
-            // mounted, or verification failed) falls back to it instead —
-            // dropping a still-live binding on a bad request would strand the
-            // visitor's run. A throw here must never skip the mail below, or the
-            // signup itself silently breaks for a bug in a provider this handler
-            // doesn't own.
-            let binding = priorBinding;
-            if (event.payload.handover) {
-                const { entityType, token: grantToken } = event.payload.handover;
-                const provider = findSignupHandoverProvider(ctx.registry);
-                if (!provider) {
-                    ctx.log?.warn("signup-request: handover payload present but no signupHandover provider mounted");
-                }
-                else {
-                    try {
-                        const verified = await provider.verifyGrant({
-                            db: ctx.db.unsafeRaw(),
-                            registry: ctx.registry,
-                            entityType,
-                            token: grantToken,
-                        });
-                        if (verified) {
-                            binding = verified;
+            const locale = resolveHandlerMailLocale(ctx, opts.locale);
+            const redis = ctx.redis;
+            const issued = await issueSignupActivation({
+                redis,
+                notify: ctx.notify,
+                email,
+                appUrl: opts.appUrl,
+                timeZone: ctx.tz.user,
+                ...(opts.tokenTtlMinutes !== undefined && { tokenTtlMinutes: opts.tokenTtlMinutes }),
+                ...(opts.appName !== undefined && { appName: opts.appName }),
+                ...(locale !== undefined && { locale }),
+                // A handover grant in this request re-verifies and replaces the prior
+                // binding; anything short of a fresh, verified grant (no provider
+                // mounted, or verification failed) falls back to it instead —
+                // dropping a still-live binding on a bad request would strand the
+                // visitor's run. A throw here must never skip the mail, or the
+                // signup itself silently breaks for a bug in a provider this handler
+                // doesn't own.
+                onTokenStored: async ({ token, ttlSeconds }) => {
+                    let binding = priorBinding;
+                    if (event.payload.handover) {
+                        const { entityType, token: grantToken } = event.payload.handover;
+                        const provider = findSignupHandoverProvider(ctx.registry);
+                        if (!provider) {
+                            ctx.log?.warn("signup-request: handover payload present but no signupHandover provider mounted");
                         }
                         else {
-                            ctx.log?.warn("signup-request: handover grant did not verify", { entityType });
+                            try {
+                                const verified = await provider.verifyGrant({
+                                    db: ctx.db.unsafeRaw(),
+                                    registry: ctx.registry,
+                                    entityType,
+                                    token: grantToken,
+                                });
+                                if (verified) {
+                                    binding = verified;
+                                }
+                                else {
+                                    ctx.log?.warn("signup-request: handover grant did not verify", { entityType });
+                                }
+                            }
+                            catch {
+                                ctx.log?.warn("signup-request: handover grant verification threw", { entityType });
+                            }
                         }
                     }
-                    catch {
-                        ctx.log?.warn("signup-request: handover grant verification threw", { entityType });
+                    if (binding) {
+                        await storeSignupHandover(redis, { token, binding, ttlSeconds });
                     }
-                }
-            }
-            if (binding) {
-                await storeSignupHandover(ctx.redis, { token, binding, ttlSeconds });
-            }
-            // normalizeEmail from the store — one source of truth for
-            // normalization; the delivery recipient + lookup path consistently
-            // get the same format.
-            const normalizedEmail = normalizeEmail(email);
-            const locale = resolveHandlerMailLocale(ctx, opts.locale);
-            await dispatchMagicLinkMail(ctx.notify, {
-                handlerName: "signup-request",
-                notificationType: SIGNUP_NOTIFICATION_TYPE,
-                renderContent: renderActivationEmail,
-            }, {
-                email: normalizedEmail,
-                appUrl: opts.appUrl,
-                token,
-                expiresAt: expiresAtIso,
-                issuedAt: issuedAt.toString(),
-                timeZone: ctx.tz.user,
-                ...(opts.appName !== undefined && { appName: opts.appName }),
-                locale,
+                },
             });
             return {
                 isSuccess: true,
                 data: {
                     kind: "signup-requested",
-                    email: normalizedEmail,
-                    token,
-                    expiresAt: expiresAtIso,
+                    email: issued.email,
+                    token: issued.token,
+                    expiresAt: issued.expiresAt,
                 },
             };
         },

package/dist/auth-email-password/handlers/token-request-handler.js

@@ -35,6 +35,7 @@ export function createTokenRequestHandler(spec, opts) {
         rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
         additionalRateLimits: [{ per: { payloadField: "email" }, limit: 5, windowSeconds: 86400 }],
         escapeHatch: {
+            grants: ["systemIdentity"],
             reason: "Anonymous requester has no session — looks up the target user by email via " +
                 "ctx.queryAs(SYSTEM, user:findForAuth) to mint the out-of-band token.",
         },

package/dist/auth-email-password/handlers/verify-email.write.js

@@ -21,6 +21,7 @@ export function createVerifyEmailHandler(opts) {
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
         escapeHatch: {
+            grants: ["systemIdentity"],
             reason: "Anonymous token holder has no session — runConfirmTokenFlow loads and updates the " +
                 "target user via ctx.writeAs(SYSTEM, user:update) to set emailVerified.",
         },

package/dist/auth-email-password/index.d.ts

@@ -9,3 +9,5 @@ export type { AccountLockoutOptions, AccountUnlockOptions, AuthEmailPasswordOpti
 export { authEmailPasswordEnvSchema, createAuthEmailPasswordFeature } from "./feature.js";
 export { AUTH_SELF_REGISTRATION_FEATURE, createAuthSelfRegistrationToggleFeature, } from "./self-registration-toggle.js";
 export { signToken, TokenPurpose, type VerifyResult, verifyToken } from "./signed-token.js";
+export { type IssuedSignupActivation, type IssueSignupActivationArgs, issueSignupActivation, SIGNUP_ACTIVATION_NOTIFICATION_TYPE, } from "./signup-activation.js";
+export { invalidateExistingSignupToken, normalizeEmail, SIGNUP_TOKEN_KEY_PREFIXES, storeSignupToken, } from "./signup-token-store.js";

package/dist/auth-email-password/index.js

@@ -17,3 +17,5 @@ export { AUTH_SELF_REGISTRATION_FEATURE, createAuthSelfRegistrationToggleFeature
 // statt eigene HMAC-Logik zu duplizieren. Purpose-string diskriminiert
 // Cross-Replay zwischen Flows.
 export { signToken, TokenPurpose, verifyToken } from "./signed-token.js";
+export { issueSignupActivation, SIGNUP_ACTIVATION_NOTIFICATION_TYPE, } from "./signup-activation.js";
+export { invalidateExistingSignupToken, normalizeEmail, SIGNUP_TOKEN_KEY_PREFIXES, storeSignupToken, } from "./signup-token-store.js";

package/dist/auth-email-password/seeding.d.ts

@@ -64,6 +64,8 @@ export type ProvisionSignupAccountOptions = {
     readonly tenantName: string;
     readonly tenantId: TenantId;
     readonly memberRoles?: readonly string[];
+    /** Stored on the new user row so the first session already carries the locale claim. */
+    readonly locale?: string;
 };
 export declare function provisionSignupAccount(db: DbConnection, options: ProvisionSignupAccountOptions, hooks?: SeedTenantHooks): Promise<{
     readonly userId: string;